tangyaofq/spring-ai-sibling-loop-pocMinimal reproduction for Spring AI ParagraphManager sibling self-loop OOM (incomplete fix of CVE-2026-47851)
Minimal reproduction for an infinite loop / OOM in
org.springframework.ai.reader.pdf.config.ParagraphManageroforg.springframework.ai:spring-ai-pdf-document-reader.Reported as a private GitHub Security Advisory to
spring-projects/security-advisories. Not a public disclosure. This repository is shared only for responsible disclosure and verification.
ParagraphManager.generateParagraphs iterates outline siblings via
getNextSibling() with no cycle detection and no iteration cap. A PDF whose
outline item declares its own /Next pointer (a sibling self-loop) causes
the loop to never terminate; each iteration appends a new to the
parent's list, exhausting the JVM heap with .
ParagraphchildrenOutOfMemoryErrorThe check added in the CVE-2026-47851 fix (depth limit + visited set) only
covers firstChild cycles, not sibling self-loops: the depth never grows past
level 1, and the visited set only records firstChild so the sibling never
enters it. The variant therefore reproduces on the latest release
(2.0.1) as well.
| Item | Value |
|---|---|
| Affected component | org.springframework.ai:spring-ai-pdf-document-reader |
| Affected versions | < 2.0.2 (all known releases; 1.x and 2.0.0 do not even contain the CVE-2026-47851 fix) |
| Vulnerable class | org.springframework.ai.reader.pdf.config.ParagraphManager |
| Trigger | new ParagraphPdfDocumentReader(resource) with a malicious PDF |
| Impact | OutOfMemoryError, process termination — DoS |
| Severity | 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Related | CVE-2026-47851 (incomplete fix) |
pom.xml — Maven build, depends on spring-ai-pdf-document-reader:2.0.1
src/main/java/ReleaseVerify.java — real user code (official API call)
poc/selfloop.pdf — 396-byte malicious PDF (sibling self-loop)
poc/normal.pdf — 384-byte control PDF (identical except no /Next self-reference)
The two PDFs differ by exactly 12 bytes — selfloop.pdf has one extra
/Next 5 0 R in the outline item, pointing the item to itself as its next
sibling.
mvn -q package
Produces target/springai-release-verify-1.0.0.jar (fat jar, includes
PDFBox 3.0.7).
# Malicious PDF — OOM in seconds
java -Xmx96m -cp target/springai-release-verify-1.0.0.jar ReleaseVerify para poc/selfloop.pdf
# Control PDF — completes normally in <100ms
java -Xmx96m -cp target/springai-release-verify-1.0.0.jar ReleaseVerify para poc/normal.pdf
The OOM occurs inside the ParagraphPdfDocumentReader constructor (which
invokes new ParagraphManager(document)); get() is never reached.
This repository exists only to support verification of the privately
reported advisory. The PDF files are harmless to PDFBox and any other
conformant PDF parser; they trigger a logic error in Spring AI's
ParagraphManager traversal only. Do not use against systems you do not own.